Run multiple services on one port and use PF's overload to switch between them

Run multiple services on one port and use PF’s overload to switch between them.Last Updated on 19 May 2010

At work we have a http/https proxy which requires authentication, I would like to access both ssh and a subversion https repository at my server.
The easy solution would be to use two IP addresses. I do not have an additional IP address available.
Using any port other than 443 also has problems, while I do have permission to tunnel these services, past experience have thought that asking the sysadmin to open another port for me would be probably take several months at least.

As a sidenote, you may be wondering why I’m not just using http for my subversion access. The reason is that the HTTP proxy we have doesn’t support certain WebDAV extensions that are required.

The solution
Use pf’s overload feature to switch between services on a given port.

Using it is simple:
I can use svn whenever I need, if I would like to use ssh I open my browser, go to http://94.142.244.51 three times in 42 seconds and I can use ssh.
After closing ssh and waiting for a minute will remove my work’s IP from the rdr_ssh table and I can use svn again.

This solution will work for FreeBSD and OpenBSD. The concept can probably be implemented in most other stateful firewalls too.

For stateful TCP connections, limits on established connections (connec-
tions which have completed the TCP 3-way handshake) can also be enforced
per source IP.
max-src-conn <number>
Limits the maximum number of simultaneous TCP connections which
have completed the 3-way handshake that a single host can make.
max-src-conn-rate <number> / <seconds>
Limit the rate of new connections over a time interval. The con-
nection rate is an approximation calculated as a moving average.

It took me some time to realize that if no service is running on port 80 the connection attempt will just time out and the 3-way handshake is not completed.

-T expire number
Delete addresses which had their statistics cleared
more than number seconds ago. For entries which
have never had their statistics cleared, number
refers to the time they were added to the table.

In other words: As long as a connection is open, the address won’t be removed, but if no connection has been open for 60 seconds the address is removed.